Including functionality from an external source via an http link may allow an attacker to inject malicious code via a MITM (man-in-the-middle) attack.

When including external pages or behaviour, use https links (instead of http) to be certain that you are getting a response from the intended server, not someone else.

Using http links is unsafe because the request sent may be intercepted by an attacker, and malicious data may be sent back in reply.

  • MDN: Subresource Integrity
  • cwe.mitre.org: CWE 830